US9544625B2

US9544625B2 - Topographic fraud detection

Info

Publication number: US9544625B2
Application number: US14/700,931
Authority: US
Inventors: Michael Sellers; Robert Zito
Original assignee: CSC Holdings LLC
Current assignee: CSC Holdings LLC
Priority date: 2010-08-18
Filing date: 2015-04-30
Publication date: 2017-01-10
Anticipated expiration: 2030-08-18
Also published as: US8601523B2; US20120047545A1; US9027070B2; US20140082650A1; US20150237385A1

Abstract

Methods and systems to detect topographic fraud are provided herein. The system includes a processor; and a memory in communication with the processor, the memory for storing a plurality of instructions for directing the processor to determine a current geographic location for a device based on polling data, determine a geographic radius within which the device is to be operated, and determine whether the device's current geographic location is outside of the geographic radius.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. Pat. No. 9,027,070, filed Nov. 21, 2013, which is a continuation of U.S. Pat. No. 8,601,523, filed Aug. 18, 2010, both of which are incorporated herein by reference in their entireties.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention generally relates to cable networks and more specifically to detecting topographic fraud in cable networks.

Background Art

In cable networks, an end user typically subscribes to a paid cable service to access cable television broadcasts using a cable modem (CM) or a digital set top box (DSTB) that is specifically assigned to that end user. The assigned CM/DSTB is supposed to be operated by a user only on their premises. For example, a user is not supposed to use the CM/DSTB to access cable television broadcasts at the premises of an acquaintance. However, currently there is no method to detect whether a CM/DSTB is being operated by a user outside of their premises.

Methods and systems are needed to overcome this deficiency.

BRIEF DESCRIPTION OF THE DRAWINGS/FIGURES

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention. In the drawings:

FIG. 1 illustrates an example system to detect topographic fraud according to an embodiment of the invention.

FIG. 2 illustrates example data structures to detect topographic fraud according to an embodiment of the invention.

FIG. 3 is a flowchart describing an exemplary process performed by a topographic fraud detection system according to an embodiment of the invention.

FIG. 4 is a block diagram of an exemplary computer system which can be used to implement the present invention.

The present invention will now be described with reference to the accompanying drawings. In the drawings, like reference numbers may indicate identical or functionally similar elements.

DETAILED DESCRIPTION OF THE INVENTION

Methods and systems for topographic fraud detection are described herein. In particular, methods and systems for detecting whether a cable modem is operating outside of its assigned geographic radius are described. According to an embodiment of the invention, cable modems on a network are periodically polled to determine their current location (a port that a cable modern is reporting in on), a billing database is accessed to determine an association between the cable modem and the user account and a geographic radius for each polled cable modem based on an associated billing address. A comparison is made to determine whether the current geographic location of the cable modern is outside of its assigned geographic radius. The examples described herein are directed towards determining whether a cable modem or a digital set top box is being operated outside of its assigned geographic radius. However, it is to be appreciated that the embodiments presented herein may also be used to detect other electronic devices that are being operated outside of their assigned geographic radius.

Embodiments are described that incorporate features of the invention. The described embodiment(s) merely exemplify the invention. The scope of the invention is not limited to the disclosed embodiment(s). The invention is defined by the claims appended hereto.

References in the specification to “one embodiment,” “an embodiment,” “an example embodiment,” etc., indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to effect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

FIG. 1 illustrates an example system to detect topographic fraud according to an embodiment of the invention. A topographic fraud detection system (TFDS) 100 is coupled to one or more nodes 112 a-m of a cable distribution system. Each of nodes 112 a-m is coupled to one or more cable modems 114 a-t. Topographic fraud detection system 100 includes a processor 102 coupled to a memory 104, a cable modem termination system (CMTS) 106 and a billing database 108. Cable modem termination system 106 includes a plurality of ports 110 a-n. Ports 110 a-n are physical hardware communication ports, that are typically part of a network card in cable modem termination system 106. Each of ports 110 is coupled to one or more nodes 112 a-n. A port 110 may be coupled to multiple nodes 112, however each node 112 is coupled to only one port 110. Furthermore, each cable modem 114 can only be coupled to a single node 112 at a time. Each cable modem 114 may include a processor 116 coupled to a memory 118. Nodes 112 receive, for example, downstream optical signals from CMTS 106 via ports 110 and convert the optical signals into electrical signals that are transmitted to cable modems 114. Similarly, nodes 112 receive upstream electrical signals from cable moderns 114 and convert them to optical signals that are transmitted to CMTS 106 via ports 110.

It is intended that each cable modem 114 be operated in a specific geographic area serviced by a specific port 110 based on its billing address. However, a user may physically move the cable modem 114 to another geographic area that is serviced by a different port 110. For example a user living in East Washington D.C. may take their cable modem 114 to a friend's house in West Washington D.C. Embodiments presented herein provide systems and methods to detect if a cable modem 114 is being operated outside of its assigned geographic area. The embodiments presented herein are described with respect to cable modems 114. However, it is to be appreciated that these embodiments are applicable to digital set top boxes as well.

In an embodiment, cable modem termination system 106 periodically polls cable modems 114 a-t. For example, cable modem termination system 106 detects active cable modem 114 a-t on its network and sends a Simple Network Management Protocol (SNMP) query to each such cable modem 114 detected on its network. In an example, “active” cable modems as referred to herein are cable modems 114 that are powered on and are in communication with CMTS 106. A “network” of a CMTS 106 as described herein includes nodes 112 and cable modems 114 that are coupled to that CMTS 106 via ports 110.

In response to the SNMP query sent by CMTS 106, each active cable modem 114 sends an acknowledgment message back to CMTS 106 via a node 112 and corresponding port 110. The acknowledgment message sent by each cable modem 114 a-t includes a media access control (MAC) address that is associated with the cable modem 114. The media access control address is unique to each cable modem 114. Based on the media access control address in the acknowledgement message, a cable modem termination system 106 can determine which port 110 a cable modem 114 is coupled to. CMTS 106 generates a “polling data” table 202 (see FIG. 2) that associates a MAC address of each active cable modem 114 with a port number through which that the cable modem 114 “reports in on.” A port 110 that a cable modem 114 “reports in on” is a port 110 that receives a message from the cable modem 114 in response to the SNMP query. Since each port 110 services a specific geographic area, table 202 effectively provides an approximate “current geographic location” of each active cable modem 114 based on the port 110 they report in on. Processor 102, based on instructions in memory 104, receives polling data 202 from CMTS 106 and uses polling data 202 to determine a current geographic location for each cable modem 114.

Billing database

108 includes billing information table 200 that associates an account number for a customer with a Media Access Control (MAC) address for one or more cable modems assigned to that account number and a billing address associated with that account number. As seen in billing information table 200, a single account may be associated with multiple cable modems. For example, account number 192 is associated with three cable modems having respective MAC addresses A, B and C and a billing address of 100 Smith St. Account 193 is associated with a single cable modern with a MAC address D and a billing address 210 Main St. Account 194 is associated with two cable modems with respective MAC addresses E and F and a billing address of 315 F St. Account 195 is associated with a MAC address G and a billing address of 90 Main Ave.

In an example, processor 106 is configured to, based on billing information 200 and instructions in memory 104, determine a “geographic radius” or port 110 that a cable modem should report in on (also referred to herein as an “assigned port”) based on the billing address associated with the account number for that cable modem 114. For example, based on the billing address for the cable modem 114 with MAC address A, processor 106 determines that the cable modem 114 with MAC address A should report in on port 110 a. The port a cable modem 114 should report in on represents the geographic radius within which the cable modem 114 can operate. A geographic radius for a cable modem 114 includes all the nodes 112 that are coupled to a port 110 assigned to cable modem 114. For example, if cable modem 114 a is assigned a port 110 a, then cable modem 114 a can operate in a geographic radius that is covered by nodes 112 a-c.

Processor

106 determines which cable modems 114 have a current geographic location that is outside of their assigned geographic radius based on data from billing information table 200 and polling data table 202. Using the MAC address as a key, processor 106 generates a fraud detection table 204, based on billing information table 200 and polling data table 202. Fraud detection table 204 associates an account number, a MAC address and a billing address for each active cable modem 114 with a port 110 that the cable modem reports in on (incoming port). Based on the billing address associated with a cable modem 114, processor 102 determines whether the port 110 that the cable modem reported in on, is within the geographic radius for that cable modem. Cable modems with MAC addresses A, B and C should report in on, for example, assigned port 110 a based on the billing address of 100 Smith st. associated with account number 192. As seen in fraud detection table 204, cable modems with MAC addressees A and B report in on port 110 a. However the cable modem with MAC address C reports in on port 110 f. Therefore, the cable modem with MAC address C is reporting in on a port (port 110 f) that is outside of its geographic radius or assigned port (port 110 a). Thus, processor 106 is configured to, based on instructions in memory 104, correlates a billing address associated with a cable modem 114 with a port 110 that the cable modem reports in on to determine whether the cable modem is operating outside of its assigned geographic radius. Processor 106, based on instructions in memory 104 compiles a list of cable modems 114 that are outside of their respective geographic radius. The list may be sent to a system (not shown) that sends a signal to shut down cable modems 114 that are operating outside of their assigned geographic radius.

FIG. 3 is a flowchart of an example process 300 depicting steps performed by TFDS 100 according to an embodiment of the invention. The steps of process 300 may be performed by, for example, processor 102 based on instructions stored in memory 104. In an alternative embodiment, the steps of process 300 may be performed by CMTS 106.

In step 302, active cable modems detected on a network are polled to determine a port that a cable modem reports. For example, cable modem termination system 106 sends an SNMP query to cable modem 114 and determines a port 110 that a cable modem 114 report in on based on the MAC address in an acknowledgment message received from the cable modem 114. Based on the port 110 that each active cable modem 114 reports in on, cable modem termination system 106 generates polling data table 202 which is used by processor 102 to determine a current geographic location of each active cable modem 114.

In step 304, a customer billing database is accessed to determine an association between an account number, a MAC address and a billing address for each cable modem. For example, processor 102 extracts data from billing database 108 to generate billing information table 200 that associates an account number with a MAC address and a billing address.

In step 306, a list is created that includes an association of a MAC address, billing address, an account number, and a port that a cable modem reports in on. For example, processor 106 based on polling data table 202 and billing information table 200 generates a fraud detection table 204 that associates an account number, a MAC address and a billing address with a port number that a cable modem reports in on.

In step 308, a geographic radius is determined within which a cable modem should be operated in based on the cable modem's billing address. For example, processor 106 based on a billing address from billing information table 200 determines a geographic radius or port that a cable modem should report in on.

In step 310, it is determined whether a cable modem is reporting in on its assigned port. For example, based on fraud detection list 204, processor 106 determines whether an incoming port for a cable modem 114 is the same as a port associated with its geographic radius.

In step 312, a list of cable modems that are outside of their geographic radius is compiled. For example, processor 102 compiles a list of cable modems that are reporting in on ports that are outside of their geographic radius. In an embodiment, the list is sent to a system that sends a signal to power down cable modems that are operating outside of their geographic radius.

The present invention, or portions thereof, can be implemented in hardware, firmware, software, and/or combinations thereof.

The following description of a general purpose computer system is provided for completeness. The present invention can be implemented in hardware, or as a combination of software and hardware. Consequently, the invention may be implemented in the environment of a computer system or other processing system. An example of such a computer system 400 is shown in FIG. 4. The computer system 400 includes one or more processors, such as processor 404. Processor 404 can be a special purpose or a general purpose digital signal processor. The processor 404 is connected to a communication infrastructure 406 (for example, a bus or network). Various software implementations are described in terms of this exemplary computer system. After reading this description, it will become apparent to a person skilled in the relevant art how to implement the invention using other computer systems and/or computer architectures.

Computer system

400 also includes a main memory 405, preferably random access memory (RAM), and may also include a secondary memory 401. The secondary memory 410 may include, for example, a hard disk drive 412, and/or a removable storage drive 414, representing a floppy disk drive, a magnetic tape drive, an optical disk drive, etc. The removable storage drive 414 reads from and/or writes to a removable storage unit 415 in a well known manner. Removable storage unit 415, represents a floppy disk, magnetic tape, optical disk, etc. As will be appreciated, the removable storage unit 415 includes a computer usable storage medium having stored therein computer software and/or data.

In alternative implementations, secondary memory 410 may include other similar means for allowing computer programs or other instructions to be loaded into computer system 400. Such means may include, for example, a removable storage unit 402 and an interface 420. Examples of such means may include a program cartridge and cartridge interface (such as that found in video game devices), a removable memory chip (such as an EPROM, or PROM) and associated socket, and other removable storage units 402 and interfaces 420 which allow software and data to be transferred from the removable storage unit 402 to computer system 400.

Computer system

400 may also include a communications interface 424. Communications interface 424 allows software and data to be transferred between computer system 400 and external devices. Examples of communications interface 424 may include a modem, a network interface (such as an Ethernet card), a communications port, a PCMCIA slot and card, etc. Software and data transferred via communications interface 424 are in the form of signals 428 which may be electronic, electromagnetic, optical or other signals capable of being received by communications interface 424. These signals 428 are provided to communications interface 424 via a communications path 426. Communications path 426 carries signals 428 and may be implemented using wire or cable, fiber optics, a phone line, a cellular phone link, an RF link and other communications channels.

The terms “computer program medium” and “computer usable medium” are used herein to generally refer to media such as removable storage drive 414, a hard disk installed in hard disk drive 412, and signals 428. These computer program products are means for providing software to computer system 400.

Computer programs (also called computer control logic) are stored in main memory 405 and/or secondary memory 410. Computer programs may also be received via communications interface 424. Such computer programs, when executed, enable the computer system 400 to implement the present invention as discussed herein. In particular, the computer programs, when executed, enable the processor 404 to implement the processes of the present invention. Where the invention is implemented using software, the software may be stored in a computer program product and loaded into computer system 400 using removable storage drive 414, hard drive 412 or communications interface 424.

Conclusion

While various embodiments have been described above, it should be understood that they have been presented by way of example, and not limitation. It will be apparent to persons skilled in the relevant art that various changes in form and detail can be made therein without departing from the spirit and scope of the embodiments presented herein.

The embodiments presented herein have been described above with the aid of functional building blocks and method steps illustrating the performance of specified functions and relationships thereof. The boundaries of these functional building blocks and method steps have been arbitrarily defined herein for the convenience of the description. Alternate boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Any such alternate boundaries are thus within the scope and spirit of the claimed embodiments. One skilled in the art will recognize that these functional building blocks can be implemented by discrete components, application specific integrated circuits, processors executing appropriate software and the like or any combination thereof. Thus, the breadth and scope of the present embodiments should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.

Claims

What is claimed is:

1. A system to detect topographic fraud, comprising:

a processor; and

a memory in communication with the processor, the memory storing a plurality of instructions for directing the processor to:

send a Simple Network Management Protocol (SNMP) query to a device;

receive an acknowledgement message from the device in response to the SNMP query, wherein the acknowledgement message includes a Media Access Control (MAC) address of the device;

determine a current geographic location for the device based on the MAC address received in response to the SNMP query;

determine a geographic radius within which the device is to be operated; and

determine whether the current geographic location is outside of the geographic radius.

2. The system of claim 1, further comprising:

a billing database, coupled to the processor, configured to store a billing address associated with the device,

wherein the memory is configured to store instructions to direct the processor to determine the geographic radius based on the billing address associated with the device.

3. The system of claim 1, wherein the memory is configured to store instructions to direct the processor to determine the current geographic location based on a port that the device reports in on.

4. The system of claim 3, wherein the memory is further configured to store instructions to direct the processor to identify the device based on the MAC address.

5. The system of claim 1, wherein the geographic radius for the device is based on a port that the device is assigned to report in on, and

wherein the port is based on a billing address associated with the device and the MAC address.

6. The system of claim 1, wherein the geographic radius includes one or more nodes that are coupled to a port assigned to the device.

7. The system of claim 1, wherein the memory is configured to store instructions to direct the processor to compare an assigned port associated with a billing address of the device and a port that the device reports in on to determine whether the current geographic location is outside of the geographic radius.

8. The system of claim 1, wherein the memory is further configured to store instructions to direct the processor to add the device to a list of devices whose current geographic location is outside of their respective geographic radius when the current geographic location is outside of the geographic radius.

9. The system of claim 1, further comprising a Cable Modem Termination System (CMTS), coupled to the processor, configured to poll the device to generate the acknowledgement message.

10. The system of claim 1, wherein the device comprises a cable modem.

11. The system of claim 1, wherein the memory is further configured to store instructions to direct the processor to send a signal to power down the device when the current geographic location is outside of the geographic radius.

12. A method to detect topographic fraud, comprising:

sending a Simple Network Management Protocol (SNMP) query to a device;

receiving an acknowledgement message from the device in response to the SNMP query, wherein the acknowledgement message includes a Media Access Control (MAC) address of the device;

determining a current geographic location for the device based on the MAC address received in response to the SNMP query sent to the device;

determining a geographic radius within which the device is to be operated; and

determining whether the current geographic location of the device is outside of the geographic radius.

13. The method of claim 12, further comprising:

storing a billing address associated with the device; and

determining the geographic radius based on the billing address associated with the device.

14. The method of claim 12, further comprising:

determining the current geographic location based on a port of a Cable Modem Termination System (CMTS) that the device reports in on.

15. The method of claim 14, further comprising:

identifying the device based on the MAC address.

16. The method of claim 12, wherein the geographic radius is based on a port that the device is assigned to report in on, and

17. The method of claim 12, wherein the geographic radius includes one or more nodes that are coupled to a port assigned to the device.

18. The method of claim 12, wherein the determining whether the current geographic location of the device is outside of the geographic radius comprises:

comparing an assigned port associated with a billing address of the device and a port that the device reports in on.

19. The method of claim 12, further comprising:

adding the device to a list of devices whose current geographic location is outside of their respective geographic radius when the current geographic location is outside of the geographic radius.

20. The method of claim 12, further comprising:

sending a signal to power down the device when the current geographic location is outside of the geographic radius.